CVE-2026-53622: Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts

What it is stated by the CNA

Traefik is an HTTP reverse proxy and load balancer. Versions prior to 3.7.3, 3.6.18, and 2.11.51 have a critical vulnerability in Traefik's HTTP/3 (QUIC) TLS configuration selection that allows unauthenticated clients to bypass router-specific mTLS enforcement. When HTTP/3 is enabled on an entrypoint, the TLS handshake selects the applicable TLS configuration through an exact, case-sensitive lookup on the SNI value, which fails to match wildcard host patterns (e.g., *.example.com) or case variants of the configured hostname. Because the handshake falls back to the default TLS configuration — which may not require client certificates — a client can complete the QUIC handshake without presenting a certificate, while the subsequent HTTP routing layer still dispatches the request to a backend protected by a router-specific mTLS policy. …

weakness

CWE-288: Authentication Bypass Using an Alternate Path or Channel

affected

traefik

published ranges

traefik < 3.7.3

first unaffected version, by branch

traefik 3.7.3

fixed by package (from OSV advisories)

github.com/traefik/traefik/v2 (Go): 2.11.51 GHSA-9cr8-q42q-g8m7 GO-2026-5287github.com/traefik/traefik/v3 (Go): 3.6.18; 3.7.3 GHSA-9cr8-q42q-g8m7 GO-2026-5287

later fixes (from OSV advisories)

github.com/traefik/traefik/v2 2.11.51 is inside a range CVE-2026-65600 (GHSA-cxjq-mrr5-89rv) lists as affected. That advisory is fixed in 2.11.52.github.com/traefik/traefik/v2 2.11.51 is inside a range CVE-2026-71324 (GHSA-3ccp-42pg-hgv6) lists as affected. That advisory is fixed in 2.11.53.github.com/traefik/traefik/v2 2.11.51 is inside a range CVE-2026-71325 (GHSA-62fc-8686-hfmq) lists as affected. That advisory is fixed in 2.11.54.github.com/traefik/traefik/v2 2.11.51 is inside a range CVE-2026-88007 (GHSA-qqjf-53cj-pwvv) lists as affected. That advisory is fixed in 2.11.57.github.com/traefik/traefik/v2 2.11.51 is inside a range CVE-2026-88008 (GHSA-w4v4-9rw7-5326) lists as affected. That advisory is fixed in 2.11.57.github.com/traefik/traefik/v2 2.11.51 is inside a range CVE-2026-88009 (GHSA-f52w-8j3h-j724) lists as affected. That advisory is fixed in 2.11.57.

severity

7.8 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

assigned by

GitHub_M

published

2026-06-23

check us github.com github.com access.redhat.com bugzilla.redhat.com

Exploit code held, dated

exploit code

None held in the PoC-in-GitHub feed. A public repository changes this brief.

What moved held, dated

8 observations held. A step marked with a scoring model moved because the measurement was replaced, not because the vulnerability changed.

Outside the record researched, cited

This section reads the record's references and adds cited findings from outside it. It needs an account. Everything above is held facts and is complete without it.

Sign in to add the researched section

How to check this

Every value above is held with two dates: when it was true upstream (as_of) and when we recorded it (tx_from). Re-derive the exploit probability as it stood on any date:

SELECT value, source, source_version, as_of, tx_from
FROM volatile_valid_as_of('CVE-2026-53622', '2026-11-01T23:59:59.999999Z', now());